The affiliate link "controversy" didn't impact user privacy or security in any way. Brave offered a pre-search affiliate option for some keywords before the use navigated. Our mistake was doing this for fully-qualified domains too. Read https://brave.com/referral-codes-in-suggested-sites/ for more details, including screenshots.

Regarding your second concern about ad notifications, these are Brave Ads. They're opt-in. And they're built on privacy and anonymity. See https://brave.com/rewards for more. A quick summary: users who opt-in to Brave Ads receive a regional catalog of ads. Their browser, locally on their device, studies the catalog for relevant items. When an ad can be shown (users determine frequency), a notification is displayed. At this time, 70% of the associated revenue is directed towards the user.

Brave Rewards is a way for users to support content creators on the Web without having to sign up for services, hand over personal information, or dig into their own pocket. It's a way to passively translate your attention into real, substantive support for the sites you visit.

You have to explicitly find and enable the ad notifications. It can actually be a bit of a PITA to enable. It's not even supported on my phone. The purpose is if you want to support websites, but don't want to spend money. The ad revenue goes in a wallet, and you decide who to disburse it to (they do have to be registered as a Creator -- Brave's system is subject to KYC laws). The revenue is small and not worth the notifications, so transferring funds to your wallet is generally a much better option.

That thread looks like someone had a device with ads explicitly enabled. Perhaps someone else set it up, or he just forgot about it. That happens all the time with software.

The case is that most of the bad press is inaccurate and overblown, and Brave has changed course when needed. Their track record is imperfect, but far better than the mainstream alternatives.

I don't have sources other than that I've been using Brave as my primary browser on all devices.

[1] is the exact same link linked to by OP and is not convincingly an issue [2] is about an opt-in system that is easily disabled if accidentally opted into